0

I'm trying to find a compression method used in executable file. I tried decompiling it with IDA Pro found a pseudocode of decompression but couldn't compile and use it in my program.

Here's pseudocode:

char __cdecl decompress(char *buffer, int a2 /* a2 argument is always 0x989680 */)
{
  unsigned __int8 v2; // al
  unsigned __int8 v3; // al
  unsigned __int8 v4; // al
  unsigned __int8 v5; // al
  FILE *v6; // eax
  char *v7; // esi
  int v8; // edi
  char v9; // al
  char v10; // bl
  int v11; // ebx
  int v12; // ebx
  int v13; // ebx
  int v14; // ebx
  char v16; // [esp+12h] [ebp-Ah]
  char v17; // [esp+13h] [ebp-9h]
  int v18; // [esp+14h] [ebp-8h]
  int v19; // [esp+14h] [ebp-8h]
  int v20; // [esp+14h] [ebp-8h]
  int v21; // [esp+14h] [ebp-8h]
  int v22; // [esp+14h] [ebp-8h]
  int v23; // [esp+18h] [ebp-4h]

  --tempFile->_cnt;
  v23 = 0;
  if ( tempFile->_cnt < 0 )
    v2 = _filbuf(tempFile);
  else
    v2 = *tempFile->_ptr++;
  --tempFile->_cnt;
  v18 = v2 << 24;
  if ( tempFile->_cnt < 0 )
    v3 = _filbuf(tempFile);
  else
    v3 = *tempFile->_ptr++;
  --tempFile->_cnt;
  v19 = (v3 << 16) + v18;
  if ( tempFile->_cnt < 0 )
    v4 = _filbuf(tempFile);
  else
    v4 = *tempFile->_ptr++;
  --tempFile->_cnt;
  v20 = (v4 << 8) + v19;
  if ( tempFile->_cnt < 0 )
    v5 = _filbuf(tempFile);
  else
    v5 = *tempFile->_ptr++;
  v21 = v5 + v20;
  if ( --tempFile->_cnt < 0 )
    v17 = _filbuf(tempFile);
  else
    v17 = *tempFile->_ptr++;
  --tempFile->_cnt;
  LOBYTE(v6) = (_BYTE)tempFile;
  if ( tempFile->_cnt < 0 )
  {
    LOBYTE(v6) = _filbuf(tempFile);
    v16 = (char)v6;
  }
  else
  {
    v16 = *tempFile->_ptr++;
  }
  v22 = v21 - 10;
  if ( v22 <= 0 )
    return (char)v6;
  v7 = buffer;
  v8 = a2; // a2 used here
  while ( 1 )
  {
    if ( !(v23 % 2000) )
      sub_48F780(); // ignore this line
    ++v23;
    if ( --tempFile->_cnt < 0 )
      v9 = _filbuf(tempFile);
    else
      v9 = *tempFile->_ptr++;
    --v22;
    v10 = v9;
    v6 = (FILE *)(v9 & 0xC0);
    if ( v6 == (FILE *)192 )
    {
      v11 = v10 & 0x3F;
      if ( v11 >= 0 )
      {
        while ( 1 )
        {
          if ( --tempFile->_cnt < 0 )
          {
            LOBYTE(v6) = _filbuf(tempFile);
            *v7 = (char)v6;
          }
          else
          {
            *v7 = *tempFile->_ptr;
            v6 = tempFile;
            ++v6->_ptr;
          }
          ++v7;
          if ( !--v8 )
            return (char)v6;
          --v22;
          if ( --v11 < 0 )
            goto LABEL_50;
        }
      }
      goto LABEL_50;
    }
    if ( v6 == (FILE *)128 )
    {
      v12 = v10 & 0x3F;
      if ( v12 >= 0 )
      {
        while ( 1 )
        {
          LOBYTE(v6) = v16;
          ++v7;
          --v8;
          *(v7 - 1) = v16;
          if ( !v8 )
            return (char)v6;
          if ( --v12 < 0 )
            goto LABEL_50;
        }
      }
      goto LABEL_50;
    }
    if ( v6 != (FILE *)64 )
      break;
    v13 = v10 & 0x3F;
    if ( v13 >= 0 )
    {
      do
      {
        LOBYTE(v6) = v17;
        ++v7;
        --v8;
        *(v7 - 1) = v17;
        if ( !v8 )
          return (char)v6;
      }
      while ( --v13 >= 0 );
    }
LABEL_50:
    if ( v22 <= 0 )
      return (char)v6;
  }
  v14 = v10 & 0x3F;
  if ( --tempFile->_cnt < 0 )
    LOBYTE(v6) = _filbuf(tempFile);
  else
    LOBYTE(v6) = *tempFile->_ptr++;
  --v22;
  if ( v14 < 0 )
    goto LABEL_50;
  while ( 1 )
  {
    *v7++ = (char)v6;
    if ( !--v8 )
      return (char)v6;
    if ( --v14 < 0 )
      goto LABEL_50;
  }
}

Also I tried signsrch, but it didn't really help. It says:

0055ad05 3051 compression algorithm seen in the game DreamKiller [32.be.12&]
0055ad08 3050 compression algorithm seen in the game DreamKiller [32.le.12&]

Is there a way to compile this pseudocode and use it in my program?

Maybe there's a tool that can determine algorithm by comparing input and output streams?

  • Why do you want't to compile the function? You already have the compiled version. Just load the executable in your self-developer program and call the existing function. – Robert Feb 19 at 14:17
  • How can I do it? Is there a way to somehow export this function to DLL or whatever? – Ovidzikas Feb 19 at 14:21
  • read Stackpoverflow, there are enough examples like this. Note sample assumes that the method is exported. As your question doe snot include any details I can't say if it is applicable or not in your case. – Robert Feb 19 at 14:27
  • This method is not exported I wonder if I load the exe into memory as a byte array and call the function in that address will it work? – Ovidzikas Feb 20 at 1:13
  • Unless it's position independent code you're going to have problems. I think you're better off getting the pseudocode to compile. What problems were you having with that? – Avery3R Feb 28 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.